NetFlow Storage Requirement Calculator

Work out netflow storage requirement instantly with clear inputs, formula shown and shareable results.

About NetFlow Storage Requirement Calculator

Flow storage is records per second times record size times retention, and sampling divides the record count directly. At 1-in-1000 sampling, 50,000 flows per second becomes 50 records per second — three orders of magnitude cheaper to store, at the cost of statistical rather than exact accounting, which is fine for capacity planning but not for forensic per-flow investigation.

Formula

Flow storage

sampled flows = flows / sampling rate; daily bytes = sampled x record size x 86400; total = daily x retention days

Worked example

With the default values below, NetFlow Storage Requirement Calculator returns Flow storage required of 21.73 GiB. Change any input above and every figure here is recalculated in your browser.

Inputs used

Flows exported per secondminimum 1: 50,000
Bytes per flow recordminimum 1 bytes: 60 bytes
Sampling rate (1 in N)minimum 1: 1,000
Retentionminimum 1 days: 90 days

Results

Flow storage required: 21.73 GiB
Daily flow volume: 247.19 MiB
Flow records after sampling: 50.0 flows/s
Export bandwidth: 0.024 Mbps

Step by step

1Values used
2Flow storage
3Flow storage required= 23,328,000,000
4Daily flow volume= 259,200,000
5Flow records after sampling= 50.0 flows/s
6Export bandwidth= 0.024 Mbps

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Does sampling break security analysis?

For volumetric detection no, but low-and-slow reconnaissance can be missed entirely. Security use cases usually need unsampled flow on critical links.

How is sampled data scaled back up?

Multiply byte and packet counts by the sampling rate. That estimate is accurate for large flows and unreliable for small ones, which is the fundamental limitation.